After backporting 8330016 to OpenJDK 17:
(https://github.com/openjdk/jdk17u-dev/commit/21502c70e11cceaaddb20c1d57a54fa72ade17c2)

...I noticed that enabling "-XX:+StressLCM -XX:+StressGCM -XX:StressSeed=123" causes crashes in test/hotspot/jtreg/compiler/arraycopy tests on AARCH64 both in MacOS and Linux.

Setting StressSeed to 0 makes these test pass. I think introducing non-zero StressSeed exposed existing C2 bugs (and in this case -- most probably R29 allocation bug).

An example:

$ make test JTREG="VM_OPTIONS=-XX:+UnlockDiagnosticVMOptions -XX:+StressGCM -XX:+StressLCM -XX:StressSeed=123" TEST=test/hotspot/jtreg/compiler/arraycopy/TestNegativeArrayCopyAfterLoop.java
...
#
# A fatal error has been detected by the Java Runtime Environment:
#
# SIGSEGV (0xb) at pc=0x0000000000000298, pid=20720, tid=20742
#
# JRE version: OpenJDK Runtime Environment (17.0.19) (build 17.0.19-internal+0-adhoc.user.jdk)
# Java VM: OpenJDK 64-Bit Server VM (17.0.19-internal+0-adhoc.user.jdk, mixed mode, sharing, tiered, compressed oops, compressed class ptrs, g1 gc, linux-aarch64)
# Problematic frame:
# J 48 c2 compiler.arraycopy.test.<init>()V (58 bytes) @ 0x0000ffff74e6d580 [0x0000ffff74e6d3c0+0x00000000000001c0]
...


Excerpts from hs_err file:


siginfo: si_signo: 11 (SIGSEGV), si_code: 1 (SEGV_MAPERR), si_addr: 0x0000000000000298

Registers:
R0=0x0000000000000000
R1=0x0000ffff8427d688
R2=0x0000000000000000
R3=0x0000ffff88bbcc78
R4=0x0000000000001300
R5=0x0000ffff897c5870
R6=0x0000000000000013
R7=0x0000ffff897cf629
R8=0x0000000000000154
R9=0x0000000000000000
R10=0x00000000a3fcf788
R11=0x0000ffff89489d38
R12=0x0000000000000000
R13=0x000000007fffffff
R14=0x0000ffff4c02c3f8
R15=0x0000000000000001
R16=0x0000ffff88aa3170
R17=0x0000ffff899e8e1c
R18=0x0000000000000000
R19=0x00000000a3fcef60
R20=0x0000ffff33606c70
R21=0x0000ffff89823e90
R22=0x0000ffff4c403bc5
R23=0x0000ffff748e17c0
R24=0x0000ffff33606ce8
R25=0x0000ffff33606e70
R26=0x0000ffff4c403c60
R27=0x0000000000000000
R28=0x0000ffff8427cfe0
R29=0x0000000000000298 <=== R29 == crash address
R30=0x0000ffff74e6d584

...

Top of Stack: (sp=0x0000ffff33606c20)
0x0000ffff33606c20: 00000000a3fcef60 0000ffff748defc8
0x0000ffff33606c30: 0000ffff74e6d494 00000000a3fce458
0x0000ffff33606c40: 0000ffff33606cd0 0000ffff748defc8
0x0000ffff33606c50: 0000ffff33606cd0 0000ffff748defc8
0x0000ffff33606c60: 00000000000003f4 00000000a3fcc060
0x0000ffff33606c70: 00000000a3fcef50 00000000a3fcef50
0x0000ffff33606c80: 0000ffff33606c80 0000ffff4c403bc5
0x0000ffff33606c90: 0000ffff33606ce8 0000ffff4c403c60
0x0000ffff33606ca0: 00000000a4001de8 0000000000000000
0x0000ffff33606cb0: 0000000000000000 0000ffff4c403bf0
0x0000ffff33606cc0: 0000ffff33606c70 0000ffff33606ce0
0x0000ffff33606cd0: 0000ffff33606dc0 0000ffff748d9140
0x0000ffff33606ce0: 0000000000000298 00000000a4178f78 <== 0x298 at [sp + 0xc0]

...

Compiled method:
(Note use of R29 in exp_count class field calculations:
  0x0000ffff74e6d3f0: ldr w29, [x10, #112]
  0x0000ffff74e6d4f8: add w10, w29, #0x1)


[Entry Point]
  # {method} {0x0000ffff4c404000} '<init>' '()V' in 'compiler/arraycopy/test'
  # [sp+0x30] (sp of caller)
  0x0000ffff74e6d3c0: ldr w8, [x1, #8]
  0x0000ffff74e6d3c4: cmp w9, w8
  0x0000ffff74e6d3c8: b.eq 0x0000ffff74e6d3d0 // b.none
  0x0000ffff74e6d3cc: b 0x0000ffff74919c00 ; {runtime_call ic_miss_stub}
[Verified Entry Point]
  0x0000ffff74e6d3d0: nop
  0x0000ffff74e6d3d4: sub x9, sp, #0x14, lsl #12
  0x0000ffff74e6d3d8: str xzr, [x9]
  0x0000ffff74e6d3dc: sub sp, sp, #0x30
  0x0000ffff74e6d3e0: stp x29, x30, [sp, #32]
  0x0000ffff74e6d3e4: mov x10, #0x3ae0 // #15072
                                                            ; {oop(a 'java/lang/Class'{0x00000000a4003ae0} = 'compiler/arraycopy/test')}
  0x0000ffff74e6d3e8: movk x10, #0xa400, lsl #16
  0x0000ffff74e6d3ec: movk x10, #0x0, lsl #32
  0x0000ffff74e6d3f0: ldr w29, [x10, #112]
  0x0000ffff74e6d3f4: ldr x19, [x28, #264]
  0x0000ffff74e6d3f8: orr w11, wzr, #0xfffff000
  0x0000ffff74e6d3fc: ldr x10, [x28, #280]
  0x0000ffff74e6d400: add x13, x19, #0x7f8
  0x0000ffff74e6d404: orr x12, xzr, #0x1
  0x0000ffff74e6d408: str w11, [x1, #12]
  0x0000ffff74e6d40c: mov w2, #0x3f4 // #1012
  0x0000ffff74e6d410: cmp x13, x10
  0x0000ffff74e6d414: b.cs 0x0000ffff74e6d494 // b.hs, b.nlast
  0x0000ffff74e6d418: str x13, [x28, #264]
  0x0000ffff74e6d41c: str x12, [x19]
  0x0000ffff74e6d420: movz x15, #0x0, lsl #16 ; {metadata({type array short})}
  0x0000ffff74e6d424: movk x15, #0x6a30
  0x0000ffff74e6d428: prfm pstl1keep, [x13, #192]
  0x0000ffff74e6d42c: str w15, [x19, #8]
  0x0000ffff74e6d430: prfm pstl1keep, [x13, #256]
  0x0000ffff74e6d434: add x10, x19, #0x10
  0x0000ffff74e6d438: mov x11, #0xfd // #253
  0x0000ffff74e6d43c: str w2, [x19, #12]
  0x0000ffff74e6d440: prfm pstl1keep, [x13, #320]
  0x0000ffff74e6d444: subs x8, x11, #0x8
  0x0000ffff74e6d448: b.cc 0x0000ffff74e6d450 // b.lo, b.ul, b.last
  0x0000ffff74e6d44c: bl Stub::zero_blocks ; {runtime_call StubRoutines (2)}
  0x0000ffff74e6d450: tbz w11, #2, 0x0000ffff74e6d45c
  0x0000ffff74e6d454: stp xzr, xzr, [x10], #16
  0x0000ffff74e6d458: stp xzr, xzr, [x10], #16
  0x0000ffff74e6d45c: tbz w11, #1, 0x0000ffff74e6d464
  0x0000ffff74e6d460: stp xzr, xzr, [x10], #16
  0x0000ffff74e6d464: tbz w11, #0, 0x0000ffff74e6d46c
  0x0000ffff74e6d468: str xzr, [x10]
  0x0000ffff74e6d46c: mov x2, #0x3f4 // #1012
  0x0000ffff74e6d470: mov w1, #0x9 // #9
   0x0000ffff74e6d474: add x0, x19, #0x10
  0x0000ffff74e6d478: bl Stub::arrayof_jshort_fill ; {runtime_call StubRoutines (2)}
  0x0000ffff74e6d47c: str x19, [sp]
  0x0000ffff74e6d480: mov x1, #0x6a30 // #27184
                                                            ; {metadata({type array short})}
  0x0000ffff74e6d484: movk x1, #0x0, lsl #16
  0x0000ffff74e6d488: movk x1, #0xc0, lsl #32
  0x0000ffff74e6d48c: orr w2, wzr, #0xfffff000
  0x0000ffff74e6d490: bl 0x0000ffff749d1340 ; ImmutableOopMap {[0]=Oop }
                                                            ;*newarray {reexecute=0 rethrow=0 return_oop=1}
                                                            ; - java.util.Arrays::copyOf@1 (line 3561)
                                                            ; - compiler.arraycopy.test::<init>@41 (line 44)
                                                            ; {runtime_call _new_array_Java}
  0x0000ffff74e6d494: str x1, [sp]
  0x0000ffff74e6d498: mov x1, #0x6a30 // #27184
                                                            ; {metadata({type array short})}
  0x0000ffff74e6d49c: movk x1, #0x0, lsl #16
  0x0000ffff74e6d4a0: movk x1, #0xc0, lsl #32
  0x0000ffff74e6d4a4: bl 0x0000ffff749d1340 ; ImmutableOopMap {[0]=Oop }
                                                            ;*newarray {reexecute=0 rethrow=0 return_oop=1}
                                                            ; - compiler.arraycopy.test::<init>@14 (line 40)
                                                            ; {runtime_call _new_array_Java}
  0x0000ffff74e6d4a8: mov x19, x0
  0x0000ffff74e6d4ac: b 0x0000ffff74e6d46c
  0x0000ffff74e6d4b0: ldr w10, [x0, #8]
  0x0000ffff74e6d4b4: eor x10, x10, #0xc000000000
  0x0000ffff74e6d4b8: ldr x10, [x10, #64]
  0x0000ffff74e6d4bc: mov x11, #0x1f10 // #7952
                                                            ; {metadata('java/lang/Exception')}
  0x0000ffff74e6d4c0: movk x11, #0x2, lsl #16
  0x0000ffff74e6d4c4: movk x11, #0xc0, lsl #32
  0x0000ffff74e6d4c8: cmp x10, x11
  0x0000ffff74e6d4cc: b.eq 0x0000ffff74e6d4f8 // b.none
  0x0000ffff74e6d4d0: mov x1, x0
  0x0000ffff74e6d4d4: b 0x0000ffff74e6d528
  0x0000ffff74e6d4d8: ldr w10, [x0, #8]
  0x0000ffff74e6d4dc: eor x10, x10, #0xc000000000
  0x0000ffff74e6d4e0: ldr x10, [x10, #64]
  0x0000ffff74e6d4e4: mov x11, #0x1f10 // #7952
                                                            ; {metadata('java/lang/Exception')}
  0x0000ffff74e6d4e8: movk x11, #0x2, lsl #16
  0x0000ffff74e6d4ec: movk x11, #0xc0, lsl #32
  0x0000ffff74e6d4f0: cmp x10, x11
  0x0000ffff74e6d4f4: b.ne 0x0000ffff74e6d524 // b.any
  0x0000ffff74e6d4f8: add w10, w29, #0x1
  0x0000ffff74e6d4fc: mov x11, #0x3ae0 // #15072
                                                            ; {oop(a 'java/lang/Class'{0x00000000a4003ae0} = 'compiler/arraycopy/test')}
  0x0000ffff74e6d500: movk x11, #0xa400, lsl #16
  0x0000ffff74e6d504: movk x11, #0x0, lsl #32
  0x0000ffff74e6d508: str w10, [x11, #112]
  0x0000ffff74e6d50c: ldp x29, x30, [sp, #32]
  0x0000ffff74e6d510: add sp, sp, #0x30
  0x0000ffff74e6d514: ldr x8, [x28, #832] ; {poll_return}
  0x0000ffff74e6d518: cmp sp, x8
    0x0000ffff74e6d51c: b.hi 0x0000ffff74e6d534 // b.pmore
  0x0000ffff74e6d520: ret
  0x0000ffff74e6d524: mov x1, x0
  0x0000ffff74e6d528: ldp x29, x30, [sp, #32]
  0x0000ffff74e6d52c: add sp, sp, #0x30
  0x0000ffff74e6d530: b 0x0000ffff749d47c0 ; {runtime_call _rethrow_Java}
  0x0000ffff74e6d534: adr x8, 0x0000ffff74e6d514 ; {internal_word}
  0x0000ffff74e6d538: str x8, [x28, #856]
  0x0000ffff74e6d53c: b 0x0000ffff74920200 ; {runtime_call SafepointBlob}
[Stub Code]
  0x0000ffff74e6d540: ldr x8, 0x0000ffff74e6d548 ; {no_reloc}
  0x0000ffff74e6d544: br x8
  0x0000ffff74e6d548: .inst 0x74904680 ; undefined
  0x0000ffff74e6d54c: .inst 0x0000ffff ; undefined
  0x0000ffff74e6d550: ldr x8, 0x0000ffff74e6d558 ; {trampoline_stub}
  0x0000ffff74e6d554: br x8
  0x0000ffff74e6d558: .inst 0x74906680 ; undefined
  0x0000ffff74e6d55c: .inst 0x0000ffff ; undefined
  0x0000ffff74e6d560: ldr x8, 0x0000ffff74e6d568 ; {trampoline_stub}
  0x0000ffff74e6d564: br x8
  0x0000ffff74e6d568: .inst 0x749d1340 ; undefined
  0x0000ffff74e6d56c: .inst 0x0000ffff ; undefined
  0x0000ffff74e6d570: ldr x8, 0x0000ffff74e6d578 ; {trampoline_stub}
  0x0000ffff74e6d574: br x8
  0x0000ffff74e6d578: .inst 0x749d1340 ; undefined
  0x0000ffff74e6d57c: .inst 0x0000ffff ; undefined
[Exception Handler]
  0x0000ffff74e6d580: b 0x0000ffff749c8400 ; {runtime_call ExceptionBlob}
[Deopt Handler Code]
  0x0000ffff74e6d584: adr x30, 0x0000ffff74e6d584
  0x0000ffff74e6d588: b 0x0000ffff74920540 ; {runtime_call DeoptimizationBlob}
  0x0000ffff74e6d58c: .inst 0x00000000 ; undefined

----

Orinal commit: https://github.com/openjdk/jdk/commit/95d2f8072e91e8df80e49e341f4fdb4464a2616e
Backport: https://github.com/openjdk/jdk17u-dev/commit/21502c70e11cceaaddb20c1d57a54fa72ade17c2